T09 · Insecure Skill Coding Practices
- Location
librarian.sh:103- Finding
Predictable Temporary File Allows Symlink-Based File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
librarian.sh, lines 103–104
Vulnerability Type: Predictable temporary file and unsafe file creation
Risk Level: MediumVulnerable Code
bash local tmp_json="/tmp/librarian-$$.json" if ! eval "$cmd" 2>/dev/null > "$tmp_json"; thenTechnical Analysis
The wrapper stores research output in a predictable PID-derived path under the shared
/tmpdirectory. Shell redirection opens this path without exclusive creation, ownership validation, or symbolic-link protection.A local attacker can anticipate or enumerate the process ID and create
/tmp/librarian-<PID>.jsonas a symbolic link before the redirection occurs. The shell then follows the link and truncates or overwrites its target with the research process output.Although
evalis unnecessary and increases command-execution complexity, the command is generated using Bash%qescaping in the reviewed implementation. The confirmed vulnerability is therefore the unsafe temporary-file operation, not a demonstrated command-injection path.Attack Path
- A local attacker identifies that the victim uses this Skill.
- The attacker predicts or enumerates a likely wrapper process ID.
- The attacker creates
/tmp/librarian-<PID>.jsonas a symbolic link to a file writable by the victim. - The victim invokes
librarian.sh. - Shell redirection follows the attacker-created symbolic link.
- The linked file is truncated and replaced with the research command's output.
- The wrapper subsequently processes and removes the temporary pathname, but this does not reverse corruption of the linked target.
Impact Assessment
Exploitation requires local filesystem access and sufficient timing or PID prediction. It does not independently grant elevated privileges.
An attacker can overwrite files writable by the account running the Skill. Depending on the selected target, this could cause:
...[truncated 354 chars]
- Remediation
View remediation
Remediation Suggestions
-
Create temporary files atomically with
mktemprather than constructing a PID-based filename:bash local tmp_json tmp_json="$(mktemp "${TMPDIR:-/tmp}/librarian.XXXXXX")" || { echo "ERROR_TEMPFILE_CREATION" exit "$EXIT_BROKEN" } -
Register cleanup immediately so the file is removed on normal exit, errors, and signals:
bash trap 'rm -f -- "$tmp_json"' EXIT HUP INT TERM -
Avoid serializing the command and executing it through
eval. Build and execute a Bash array directly:bash local cmd=( python3 "$RESEARCH_PY" "$query" ) if [[ "$scope_type" == "topic" ]]; then cmd+=(--topic "$scope_value") elif [[ "$scope_type" == "book" ]]; then cmd+=(--book "$scope_value") else echo "ERROR_INVALID_SCOPE" exit "$EXIT_BROKEN" fi cmd+=(--top-k "$top_k") if ! "${cmd[@]}" >"$tmp_json" 2>/dev/null; then echo "ERROR_EXECUTION_FAILED" exit "$EXIT_BROKEN" fi -
Apply restrictive permissions with
umask 077before creating the file if the search output may contain sensitive excerpts. -
Preserve validation exit codes before cleanup rather than relying on
$?afterrm, ensuring malformed output cannot be reported as success.
-